Search Head Clustering

Required configuration for Search Head clusters

Overview

The Recorded Future Add-on for Splunk Enterprise Security is designed to run on Search Heads within a Splunk system. In the case of a Search Head cluster (SHC) the installation proceedure is the standard one for SHCs, ie it should be installed on the deployer node and then deployed the SHC nodes.

Before deploying the app the required configuration change below should have been made to ensure SHC configuration coherency.

The app will detect that it is operated on a SHC. Only the captain node of the SHC will run the modular inputs for updating risklists and alerts.

Required configuration

In order to maintain coherent configuration across the SHC it is necessary to modify the list of configuration file types that are synchronized across the SHC. Two additional configuration files are required:

  • input.conf which contains the configured modular inputs used to update risklists and alers.
  • ta_recorded_future_settings.conf which contains the configure API key (encrypted) and various app specific settings.

Splunk does not allow apps to ship with the required configuration settings at this time so this configuration must be done by the customer.

The following stanza is needed in $SPLUNK_HOME/etc/system/local/server.conf:

[shclustering]
conf_replication_include.ta_recorded_future_settings = true
conf_replication_include.inputs = true

Once this change had been made and the app has been deployed it's possible to connect to any of the SCH search head nodes and perform setup.

 
 
Was this article helpful?
0 out of 0 found this helpful

The content of this article is confidential and intended solely for the use of individuals with authorized access to the Recorded Future service. Do not download or distribute this article.
Have more questions? Submit a request

Comments

0 comments

Please sign in to leave a comment. Please note that your name will be displayed. If you would like to change how your name appears, please update your profile name.